API Single Sign-On Gateway with Centralized Token Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SSO implementations for API access across multiple applications lack centralized management of API keys and fine-grained access control, leading to complex token management and security vulnerabilities.
Innovation Solution
A system and method that extends the identity provider to act as an API gateway, enabling a master API token for accessing multiple applications, with centralized key management and fine-grained access policies, allowing users to authenticate once and access multiple APIs using a single authentication mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional SSO implementations are used for API access across multiple applications, then users can authenticate once and access multiple applications, but centralized management of API keys and fine-grained access control are lacking
Solution Approach 1:
The patent combines multiple authentication tokens into a single parent token that can access multiple child applications. The identity provider issues one parent token to the client, which then manages access to multiple child application tokens, simplifying token management while maintaining security.
Solution Approach 2:
The parent token is designed with universal functionality to access multiple child applications across different services. A single parent token can authenticate against multiple child applications without requiring separate authentication credentials for each application.
2Adaptability or versatility
If traditional SSO implementations are used for API access, then access to multiple applications is enabled, but fine-grained access control policies are not provided
Solution Approach 1:
The patent segments access control into hierarchical levels with parent tokens having broader access rights and child tokens having specific application-level permissions. This segmentation enables fine-grained control where each child application can enforce its own access policies while the parent token provides overarching authentication.
Solution Approach 2:
Different access control policies are applied at different levels of the token hierarchy. The parent token level handles global authentication and authorization policies, while child application levels implement specific local access controls tailored to each application's security requirements.
3Productivity
If multiple API keys are managed for different applications, then access to various APIs is enabled, but centralized key management is lacking
Solution Approach 1:
The parent token acts as an intermediary between the client and multiple child application tokens. Instead of managing multiple separate API keys, the client obtains one parent token that mediates access to all child applications, reducing key management complexity while maintaining efficient API access.
Data Source
AI summary
The present disclosure provides a method implemented by a client for managing application programming interface (API) access. The method includes sending a first request to create a system session comprising a master API token, receiving a system session token in response, sending a second request to create a first application session for a first target application comprising the master API token, system session token, and a first identifier, receiving confirmation of the first application session creation, sending a third request to invoke a first API of the first target application comprising the master API token, system session token, first identifier, and a first payload, and receiving a first result from the first API in response to the third request. The method enables unified API access across multiple applications using a single master API token and system session token.